Authorization Bypass Vulnerability in Points and Rewards for WooCommerce Plugin by WordPress

CVE-2026-10628

What is CVE-2026-10628?

The Points and Rewards for WooCommerce plugin for WordPress contains a vulnerability that allows authenticated users, including those with subscriber-level access, to bypass authorization checks. This flaw enables attackers to convert reward points into wallet balances, exfiltrate sensitive user data like emails and point balances to a compromising Klaviyo account, and overwrite the site's Klaviyo API key. Additionally, the vulnerability permits attackers to modify settings related to campaign banners and user access within the points system. This issue arises from improper nonce verification within public-facing pages, facilitating exploitation by both authenticated users and unauthenticated visitors.

References